Westbrooke

Any idea how many gigabit (or lower) connections you'll need at the core for servers etc? Also, do you think you will just need layer 2 switching (standard ethernet) or are you going to need layer 3 (an expensive add on unless you are starting to use routed subnets or VLANs. This includes using VoIP!)

Thought I'd chip in with a few design comments. Don't know what level of knowledge you are starting from, so sorry if any of this is beneath you! Fibre is great for links between cabinets. In theory you can achieve much the same with Cat6 links these days, but they are a pain in the a**e! (although in some setups I use both as redundant links). One thing you need to look at is whether to install OM2 or OM3 grade fibre. They will both work, but OM3 can be pushed to 10Gb. You also need to think about how many cores to pull (2 cores per connection). I normally get 8 core fibre installed, because so much of the cost is paying the bloke to lay it, and then you get spare capacity. It sounds as if you are buying a lot of new kit, as opposed to adding some small upgrades to the existing setup (although I assume you will be re using some kit) Ideally, you should aim for a simple collapsed backbone model with a good core switch feeding a number of edge switches. If possible, you need to avoid a second level of cascade in the cabinet, so if you have multiple switches either go for multiple separate uplinks (can get pricey) or make sure they are properly stacked. (note that some modern swithches can be stacked using the GB uplink ports) The core switch should supply all the edge switches and the servers. Everything else comes off edge switches. The trick to selecting the kit is to look at the backplane speed. These rate from about 1Gb for an edge switch up to about 256G for a Cisco core switch. There is obviously no point feeding a dozen GB links into a switch with a 4 Gb backplane as you'll simply run out of bandwidth. I'd agree with previous posters on the HP stuff - very nice. I've also used 3Com for years on very large networks and it also works well and can be very cost effective. In both cases you need to make sure you have the right switches. Oh, and you mentioned keeping the cost down. the biggest trick is to use fixed configuration switches (ie the ones with little or no expansion) but get the right ones. you may a lot for the upgrade capacity. If you let me know the number of active (I assume 10/100) ports you want in each cabinet and the number of (Gb) server connects, I'll have a look at the 3Com and HP options for you.

Biggest argument for not doing cabling is that you get a 25 year warranty on the cabling if it is installed and tested by an approved installer. Personally, I would never put in network cabling as it would not be certified. Note that if you run it yourself and it is not fully tested (you need a full set of results from something like a Fluke tester) not just a yes/no test from a cable tester, then it cannot be considered to be Cat5e, even if you have used Cat5e components. The standard includes lots of detail about how the wiring is laid, terminated and the tolerances allowed on testing. I can guarentee that you will get problems if you do your own cabling - although you may never pin them down to the cables unless you test them...

Before you added the Win2003 server, what were the DC(s) running? The Windows 95/98 networking client won't authenticate against a 2003 server...

Agree with everyone else on Axis cameras. For recording, there is the Axis software, or the next step is systems from Milestone or Lenel. I've just put in a multi camera system with cameras indoors and out with 3 week recording using the Lenel system, but that was picked as I was also doing access control (proximity cards) for 20+ doors. The Axis system is probably your best choice - separate modules for viewing and recording. If you are border, make one of the cameras PTZ (Pan, Tilt, Zoom) so you can control it remotely! POE is simplest - you always want cameras where it is difficult to get power. If your switches are not PoE, then an injector is fine. As for other thing you can do with your network, the sky's the limit. VoIP is simple (but requires a quality network), access control for doors, control of lights, electric blinds and screens...

OK, starting with the techies, the relevant registry keys for the Explorer Shell folders are: Key Name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: AppData Name: Cookies Name: Desktop Name: Favorites Name: NetHood Name: Personal Name: PrintHood Name: Recent Name: SendTo Name: Start Menu Name: Templates Name: Programs Name: Startup Name: Local Settings Name: Local AppData Name: Cache Name: History Name: My Pictures Name: Fonts Name: My Music Name: Administrative Tools Name: CD Burning Name: My Video Note the ability to control things like the Programs sub menu separately from the Start menu, and that the Cache might roam, as well as the power you have over all those annoying My Documents/Pictures/Music/Video folders. Most of what you want can be achieved by setting these keys directly, but not very subtle! See http://support.microsoft.com/default.aspx?scid=kb;en-us;315415 for the correct way to take folders out of the roaming profile (ie leave them fixed per machine - so you will need to separately redirect them if you want them on a server)

I know that was a risky post! I'm going to have to look up the details - the only constnat thing about redirecting profile folders is that MS have changed the way it is done in every version? (although the registry hacks tend not to change - they just add more folders...) Win 2000/XP start with the premise that you can include and exclude folders from the roaming system, so it is a bit simple. I'll get back to you with how! (NB - you can use the redirection/roaming tricks in reverse to - I have often redirected personal settings stuff such as ini files from the local drive to Application data - programs never designed to roam then start roaming happily!)

Would it be a good idea to have a froum for telphony issues? I think most support staff get sucked in to telephone issues from time to time, and with VoIP becoming a hot topic I think there are a lot of people with questions who would benefit from sharing ideas. If you do set one up I 'm happy to hand around from time to time and aswer questions - I'm one of the rare people who does both voice and data. Maybe specifically put Telephony and VoIP as the heading?

Index DT1 phones are not VoIP, they are digital handsets specific to the Index phone switch (the do also work on the IP office) Tney are the most basic model, and as suich have a finite life. I imagine most of yours are quite old, and repalcements are probably reconditioned as opposed to new. Some of the problems sound like wiring problems, but some just sound like old handsets. Anything over 5 years old has probably had it, recon stuff last about 2 years. In response to what is required for a VoIP network - basically managed switches that suport the latest QoS and VLANs. You get the benefits if you run both voice and data on the same LAN (no one recomedns separate networks - might as well save money and buy a traditional TDM system instead) The voice traffic will not affect your data, (very small) but you do need to stop the data affectingthe time crtitical voice packets, hence QoS and VLANs. I can tell you lots more about VoIP and phones in general - just put in a 100 user Avaya Call manager (Definity) VoIP system and used to run a 1000 user Mitel SX2000 (digital) system - Just ask!

Sounds like fun! First, make sure you reduce the DHCP lease time on your new setup - 3 days is more usual to jelp avoid problems. Exact behaviour of DHCP depends on the verisons of client and server (although it is supposed to be a standard) Basically, if I remember correctly, clients will try to get a renewal after half the lease time has expired. If they don't get one, they will carry on with the old IP until the leae runs out. However on boot up they should try and check their lease with the DHCP server they got it from, and hope for an acknowledgement (ACK). Unless you plan on waiting 30 days (I suspect not) you need to get this boot up process to deliver a negative acknowledgement (NACK) To do this you first need to make sure that your DHCP server knows that these addresses are no longer valid. By the sound of it you have done that. The second part is to make sure that machines booting up with the old IP address can still access the DHCP server. If they can't, they will just carry on withthe old IP address. It sounds as if part of the IP address changes you have made as removed the valid network route from PCs with old numbers to the DHCP server with an old number. Have you change the whole IP subnet and re addressed the DHCP server? If that is the case, you have 2 options. 1. run arund all the machines and renew manually :-) 2. Set the DHCP server up as dual homed - with two IP addresses (old and new) and set to cancel the old scope and issue addresses on the new scope. Then reboot PCs and you are away. Once they are all done, don't forget to tidy up the DHCP server. Hope that helps.

This is easy to answer with pictures, but I'll stick to words for now! The default gateway is the address of the device that knows how to get places not on the LAN, in most cases the firewall or internet router. I am assuming that you have a single LAN - no routers on your internal network! Before you had a proxy server, each workstation would have accessed the internet directly to get web pages. This means it needed to know how to get to the router, which would have sent packets on to the right place. With a web proxy, each PC only needs to know how to get to the proxy server, which is on the LAN so that is easy. The proxy server is then the only server that needs to know about the outside world, so it will need an accurate default gateway set. In other words, if all services use a proxy server, then the default gateway on PCs on the LAN is not relevant, so can be blank or wrong! Of course, you can use ISA server as a router, firewall and/or proxy so setups can get a lot more complicated! Note you also need to have DNS proxied somewhere for things to still work, but that would be pretty standard setup (your internal DNS server will be a DNS forwarder) (NB - a better design is to have the proxy in a DMZ, so there is a firewall between the LAN and the proxy, and again between the proxy and the outside world. However, removing the direct link between internal machines and the internet is a GOOD THING) Hope that helps!

Is this a question about preventing users installing sofware (easy) or preventing them running executable content from a removable disk (or other location) that does not require an install (hard)?

Nice to see this topic is still discussed. I first implemented roaming profiles in schools 10 years ago (original release of Win 95 on NT4 Server). Have since roamed with 98, Win2000 and XP (always avoided ME like the plague!) First comment: Roaming profiles are incredibly useful in schools - let's face it, the users roam, so their personal settings should too. Second comment: I strongly agree with the comments about standardising heavily for pupils and controlling most of what they see - I just wouldn't go as far as a madatory profile. Third comment: I have never understood Microsoft's view as to what should roam. I think they test these things with 2 machines and a gigabet network... Roaming profiles have only ever worked if you take control of the profile first. So how do you make it all work? Divide the profile up into three types of information: 1. The bits that must rove properly and be downloaded to the local machine. In many cases you can get this down to just user.dat, although there may be the other odd file you want to include such as normal.dot. 2. The bits you want to keep personal, but don't need to be pulled down. These can be redirected to folders on the server personal to each user. This would include my documents, recent, favorites (in answer to an earlier question) and many others. 3. The bits you want to remove from the personal profile and make mandatory for groups (Start menu, programs, desktop etc). These can be pointed to a common server folder with permissions set to prevent changes being made. For various reasons, I tend to modify section 3 and synchronise key folders to all local machines and point profiles at the local copy - speeds things up and is more reliable, and works on laptops! To get all the bits to work you need to be familiar with using the various policy tools and creating new policy templates. Personally, I usually cheat and write the settings derectly into the registry - it is more relaible and allows you control over elements that Microsoft 'forgot' to include int he tools. Note that all this can be achieved with even without AD in the background if you are clever. If anyone has any specific questions on help getting things working, I'd be happy to advise.